2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:49

Target

023d9e9742a378b55cbd778c66d2e6da.dll
Size

32KB
MD5

023d9e9742a378b55cbd778c66d2e6da
SHA1

9bc221b2545e9103a42ac18c5e199ca8fe683714
SHA256

2f1aaf160e692fc2c496437f6b93502ae9fde2f1223a6189fca4638199b90d3e
SHA512

aee1da53815c8e3017056396ef438b11b598aeac515f7acd68278d5a2172816498d3a39bdfff0c297291e9b4b39c7e2f9e7d48fb6e3faa50578f5b3072ecd777
SSDEEP

768:5bQqCiZHgb+X6glv+CrCgmUSacGo3VBffd6722MDylb0OqOSBRBw:5bhCiZAW6glv+CrCgmUSacGo3VBfQ72u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1876	3064	rundll32.exe	18
PID 3064 wrote to memory of 1876	3064	rundll32.exe	18
PID 3064 wrote to memory of 1876	3064	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\023d9e9742a378b55cbd778c66d2e6da.dll,#1
  2⤵
  PID:1876